923b2d7c89c56b5256b9b6e1fef367705651b0a8a023e4e747f0e36b68c50b3e

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 00:01

Target

c9f8575205a972d67fab50faf5a15dbf.exe
Size

39KB
MD5

c9f8575205a972d67fab50faf5a15dbf
SHA1

dd5f8b4bc34e012422349f5389cde94a95af51bf
SHA256

923b2d7c89c56b5256b9b6e1fef367705651b0a8a023e4e747f0e36b68c50b3e
SHA512

6dde35255914025f64f6e6dc037d3d4f56c689e71d4cdf88fe6350716dd8a83c700514d88b75d8052208d09583961c5ae8f7f0fe3f009588bffa05097d29c82b
SSDEEP

768:BJMYEFliSuRiIs1kRzDaasC2Tvnt8nnweFm/XM+OenJKP/:BuNZ5P1kd7F+nFeFi8PIm

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2144	2192	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2144	2192	c9f8575205a972d67fab50faf5a15dbf.exe	28
PID 2192 wrote to memory of 2144	2192	c9f8575205a972d67fab50faf5a15dbf.exe	28
PID 2192 wrote to memory of 2144	2192	c9f8575205a972d67fab50faf5a15dbf.exe	28
PID 2192 wrote to memory of 2144	2192	c9f8575205a972d67fab50faf5a15dbf.exe	28

C:\Users\Admin\AppData\Local\Temp\c9f8575205a972d67fab50faf5a15dbf.exe
"C:\Users\Admin\AppData\Local\Temp\c9f8575205a972d67fab50faf5a15dbf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 88
  2⤵
  - Program crash
  PID:2144

memory/2192-0-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download
memory/2192-1-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download